How to Fill Out a Chain of Custody Form (With Example)

How to Fill Out a Chain of Custody Form (With Example)

A chain-of-custody form documents the life of an evidence item so that, later, anyone can reconstruct exactly where it has been. The form is simple; filling it out completely and contemporaneously is what makes it defensible. Here is what each part is for.

Why the form matters

A chain of custody is a chronological record of the handling and storage of an item from its point of collection to its final return or disposal, as established in forensic evidence handling standards [1]. This is not administrative convenience. When evidence is offered in court, it must be authenticated—the party offering it must establish that it is what it claims to be, and that it has not been altered, substituted, or contaminated since collection [12]. The chain of custody is the mechanism by which that authentication occurs. Without a complete and unbroken record, evidence may be excluded from trial or given reduced weight by the trier of fact [5]. It is the difference between an item that is admissible and one that is not.

What fields belong on a chain of custody form

A chain of custody form must capture five categories of information [4]:

1. Item identification and case linkage — the evidence itself, uniquely identified and tied to the matter
2. Collection details — who collected it, when, where, under what legal authority, and in what condition
3. For digital evidence: acquisition details — the method, tool, source, hash value, and the date and time of acquisition
4. Each transfer between custodians — who released it, who received it, when, and for what purpose
5. Storage location and access control — where it was kept and how security was maintained between transfers

The foundational standard for forensic evidence handling specifies that the form must identify each person in the chain and document the purpose of each transfer, creating what practitioners call "a chain of receipts" [1, 4]. Missing any of these five categories leaves a gap that may, in litigation, be challenged as a break in the chain.

1. Item Identification

Assign the item a unique identifier (a number or code assigned by the receiving agency or laboratory, not a case number). Create a plain-language description specific enough that no one could confuse this item with another. For physical items, include make, model, serial number (or state that none is present), color, approximate weight, dimensions, and any distinguishing marks—a scratch, repair, modification, or seal. For biological specimens, record the specimen type, the method used to obtain it, the donor identifier or initials, and container details. For digital devices, record device type, model, operating system version, IMEI or serial number (if present), and any visible damage or alteration. Tie the item to the matter with a case or matter number [1, 4].

Specificity is not decoration. It is the foundation. A vague description creates ambiguity; ambiguity creates reasonable doubt about whether this is actually the item that was collected.

2. Collection Details

Record who collected the item (name, title, agency, and identifying number such as a badge number or employee ID). Record when it was collected—the date and time to the minute, not merely the date. Record where it was collected (street address, room number, coordinates, or other precise location). Document the condition of the item at the moment of collection—sealed or unsealed, locked or unlocked, powered on or off, in a protective container or exposed, bearing any tamper-evident seals or devices [1].

If collection was authorized by search warrant, consent form, plain-view observation, or other legal authority, record it by reference (for example, "pursuant to Search Warrant W-2026-118, issued by Judge [name] on [date]") [4]. This connection between the custody record and the lawfulness of the seizure is critical: it preserves the record of how the item came into official possession, and allows any later examination of whether the seizure itself was lawful [5].

3. Digital Evidence: Acquisition Details

Digital items require documentation beyond physical handling. When a digital device or storage medium is seized, it must be acquired—that is, copied or extracted in a way that preserves the data and proves later that the copy is an exact match to the original. Record:

• The acquisition method — physical bit-by-bit imaging (a complete sector-level copy of the entire storage medium), logical extraction (copying only files and data within the file system), acquisition of unallocated space (recovery of deleted data), or live acquisition (capture from a running device without powering off) [13, 15]
• The tool used and its version number (for example, Encase 8.0, FTK 7.2.1, or other forensic software) [1]
• The source device or location — the physical drive, partition, volume, or connected device the data came from
• The hash value and the algorithm used to compute it (for example, SHA-256) [1, 13]
• The date and time of acquisition to the minute [1]
• Whether the source device was write-protected during acquisition (connected via a hardware write-blocker or similar device that prevents any modification to the original) [13]

The hash is the single most important field for digital evidence. A hash is a mathematical fingerprint of data: a unique value computed from every bit of the acquired data. If even one bit changes, the hash changes completely and detectably. By recomputing the hash at later stages—at trial, during defense examination, or before presenting the evidence—you can demonstrate that the digital evidence in court is byte-for-byte identical to what was originally acquired. Without a hash, you cannot prove this, and the opposing party can plausibly contend that the data has been altered, deleted, or substituted [13, 15].

4. Transfers of Custody

Every time the item changes hands, record it as a two-party event: who released it, who received it, the exact date and time of the transfer (including the hour and minute), and the purpose of the transfer (examination, testing, authentication, storage in a different location, presentation in court, return to property owner) [4]. Whenever possible, both the releasing party and the receiving party should acknowledge the transfer—with signatures, initials, printed names, badge numbers, or electronic timestamps [4, 6].

This is where paper chains most often break: an item moves from one person to another, the item is used, it is returned, but no one fills in a line on the form. The transfer happens; the documentation does not. A gap in the record is a break in the chain [5]. Every link must be filled. Include not just person-to-person transfers but also transfers of the item within a laboratory from one examiner to another, transfers from the laboratory to an outside testing facility, and transfers from one storage location to another [1, 6].

What constitutes a transfer is generous: any change of custody, any change of location, any period of time in which the item was out of direct control or supervision should be documented [4].

5. Storage and Access Control

Between transfers, record where the item was stored—evidence locker, locked cabinet, safe, refrigerated unit, access-controlled server, or other secured location [1]. Record how access was controlled—who had keys, who had passwords, how visitors were screened, whether an access log was maintained. If the item was stored in a secure facility with maintained access logs, make clear that those logs exist, document their location, and ensure they are produced as part of the discovery process [6].

Storage without documented access control is a weak point in a chain. If an item sat in an unlocked room for hours or days with no supervision and no sign-in log, or if an access log was kept but is not produced, the chain is compromised. The prosecutor may argue there was no opportunity for tampering; the defense may contend the opposite. Documentary evidence of access control resolves the question [1, 6].

Contemporaneous Completion: The Critical Rule

The entire chain of custody must be filled out at the time each event occurs, not reconstructed later from notes or memory [1, 4]. An entry made days after the event, from handwritten notes, carries less weight and invites challenge: Was the writer sure of the date? The time? The transfer? Did they omit something they didn't remember? Contemporaneous entries—made as the event happens—are the gold standard and are far more defensible [4, 5].

In cases where chain-of-custody timing is contested, or where the defense contends the evidence was out of sight or unsupervised for an unrecorded period, the dates and times on the form become crucial. They may be compared against independent records: laboratory logbooks, security camera footage, email timestamps. If the custody form says an item was transferred at 2:00 p.m. but a security camera shows it was sitting unsecured at 2:30 p.m., the discrepancy is a problem. Fill the form in real time.

A Worked Illustrative Example

The following example uses placeholder case numbers, item identifiers, names, and dates to illustrate correct format and required fields. The specific details are not from an actual case:

Case Number: [Case number]

Item ID (Assigned by Lab): [Laboratory item identifier]

Item Description: Apple iPhone, current-generation model (black), visible hairline crack on front screen, IMEI [device identifier], no visible water damage or modifications at receipt. Device powered off.

Collection Details:

Collected by: [Detective name], [Police agency], Badge [number]

Date and time: [Date], [time in 24-hour format]

Location: [Street address], [Apartment or room number]

Legal authority: Search Warrant [number], issued by Judge [name], [date]

Condition upon collection: Device powered off, placed in anti-static bag, undamaged (crack pre-existing from before seizure), no visible tamper seals

Digital Acquisition:

Acquisition method: Logical extraction (files and file system only, no unallocated space)

Tool: [Forensic software name and version]

Source: The seized iPhone, [item identifier]

Date and time of acquisition: [Date], [time in 24-hour format]

Write-protected: Yes (hardware write-blocker used during acquisition)

Hash algorithm: SHA-256

Hash value: [Computed hash value]

Transfer 1:

Released by: [Name], [Title], on [date], [time]

Received by: [Name], [Title], on [date], [time]

Purpose: Forensic examination and reporting

Acknowledgment: [signature or electronic receipt recorded]

Storage:

Storage location: [Laboratory name], secure evidence locker, locked cabinet

Access control: Locker access limited to laboratory personnel with badge key. Access log maintained in laboratory evidence management system. Log accessible for inspection.

Each entry in a completed form is specific, timestamped, and attributable. The hash permits verification: an independent examiner can later recompute the hash from the stored acquisition and confirm it matches the original, proving the data is unchanged.

Common Gaps That Create a Break

• Blank transfer lines — an item moved but no one filled in the transfer entry
• Non-contemporaneous entries — filled in days later from memory or notes
• No hash or integrity value for digital evidence
• Vague descriptions ("phone," "documents," "hard drive") that could match multiple items
• No legal basis recorded for collection
• No access control documented for storage
• Editable records with no protection against back-dating or alteration, particularly in paper systems
• No acknowledgment by the receiving party
• No time recorded, only a date

Retention of the Form

For biological specimens, federal regulation establishes that laboratories must retain positive specimens in long-term frozen storage for at least 1 year, and "the laboratory shall retain any specimens under review or legal challenge until they are no longer needed" [3]. The chain of custody form itself—the documentation—should be retained for the duration of the case, any appeals, and in many jurisdictions, indefinitely [3, 7].

The form is the institutional memory of the evidence. Once the evidence is destroyed (following a formal disposition order), the form remains as the only record of how the evidence was collected, handled, and tested. Courts and prosecutors may need to refer to it years after the case closed. Destruction of the form should occur only after a formal disposition process and with approval from the relevant court or prosecutorial authority [1, 3].